Working Skelleton
This commit is contained in:
+21
@@ -0,0 +1,21 @@
|
||||
The MIT License (MIT)
|
||||
|
||||
Copyright (c) 2014-2018 Evan Hahn, Adam Baldwin
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in all
|
||||
copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
SOFTWARE.
|
||||
+30
@@ -0,0 +1,30 @@
|
||||
X-XSS-Protection middleware
|
||||
===========================
|
||||
[](https://travis-ci.org/helmetjs/x-xss-protection)
|
||||
[](http://standardjs.com/)
|
||||
|
||||
[_Looking for a changelog?_](https://github.com/helmetjs/helmet/blob/master/HISTORY.md)
|
||||
|
||||
The `X-XSS-Protection` HTTP header is a basic protection against XSS. It was originally [by Microsoft](http://blogs.msdn.com/b/ieinternals/archive/2011/01/31/controlling-the-internet-explorer-xss-filter-with-the-x-xss-protection-http-header.aspx) but Chrome has since adopted it as well.
|
||||
|
||||
This middleware sets the `X-XSS-Protection` header. On modern browsers, it will set the value to `1; mode=block`. On old versions of Internet Explorer, this creates a vulnerability (see [here](http://hackademix.net/2009/11/21/ies-xss-filter-creates-xss-vulnerabilities/) and [here](http://technet.microsoft.com/en-us/security/bulletin/MS10-002)), and so the header is set to `0` to disable it.
|
||||
|
||||
To use this middleware:
|
||||
|
||||
```javascript
|
||||
var xssFilter = require('x-xss-protection')
|
||||
app.use(xssFilter())
|
||||
```
|
||||
|
||||
To force the header to be set to `1; mode=block` on all versions of IE, add the option:
|
||||
|
||||
```javascript
|
||||
app.use(xssFilter({ setOnOldIE: true }))
|
||||
// This has some security problems for old IE!
|
||||
```
|
||||
|
||||
You can also optionally configure a report URI, though the flag is [specific to Chrome-based browsers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection). This option will report the violation to the specified URI:
|
||||
|
||||
```javascript
|
||||
app.use(xssFilter({ reportUri: '/report-xss-violation' }))
|
||||
```
|
||||
+29
@@ -0,0 +1,29 @@
|
||||
module.exports = function xXssProtection (options) {
|
||||
options = options || {}
|
||||
|
||||
var headerValue = '1; mode=block'
|
||||
if (options.reportUri) {
|
||||
headerValue += '; report=' + options.reportUri
|
||||
}
|
||||
|
||||
if (options.setOnOldIE) {
|
||||
return function xXssProtection (req, res, next) {
|
||||
res.setHeader('X-XSS-Protection', headerValue)
|
||||
next()
|
||||
}
|
||||
} else {
|
||||
return function xXssProtection (req, res, next) {
|
||||
var matches = /msie\s*(\d+)/i.exec(req.headers['user-agent'])
|
||||
|
||||
var value
|
||||
if (!matches || (parseFloat(matches[1]) >= 9)) {
|
||||
value = headerValue
|
||||
} else {
|
||||
value = '0'
|
||||
}
|
||||
|
||||
res.setHeader('X-XSS-Protection', value)
|
||||
next()
|
||||
}
|
||||
}
|
||||
}
|
||||
+116
@@ -0,0 +1,116 @@
|
||||
{
|
||||
"_args": [
|
||||
[
|
||||
{
|
||||
"raw": "x-xss-protection@1.1.0",
|
||||
"scope": null,
|
||||
"escapedName": "x-xss-protection",
|
||||
"name": "x-xss-protection",
|
||||
"rawSpec": "1.1.0",
|
||||
"spec": "1.1.0",
|
||||
"type": "version"
|
||||
},
|
||||
"/Users/gerrit/Documents/dev/nodejs/rentfor.camp/html/RentForCamp/node_modules/helmet"
|
||||
]
|
||||
],
|
||||
"_from": "x-xss-protection@1.1.0",
|
||||
"_id": "x-xss-protection@1.1.0",
|
||||
"_inCache": true,
|
||||
"_location": "/x-xss-protection",
|
||||
"_nodeVersion": "9.5.0",
|
||||
"_npmOperationalInternal": {
|
||||
"host": "s3://npm-registry-packages",
|
||||
"tmp": "tmp/x-xss-protection_1.1.0_1520008389451_0.7745512106215868"
|
||||
},
|
||||
"_npmUser": {
|
||||
"name": "evanhahn",
|
||||
"email": "me@evanhahn.com"
|
||||
},
|
||||
"_npmVersion": "5.6.0",
|
||||
"_phantomChildren": {},
|
||||
"_requested": {
|
||||
"raw": "x-xss-protection@1.1.0",
|
||||
"scope": null,
|
||||
"escapedName": "x-xss-protection",
|
||||
"name": "x-xss-protection",
|
||||
"rawSpec": "1.1.0",
|
||||
"spec": "1.1.0",
|
||||
"type": "version"
|
||||
},
|
||||
"_requiredBy": [
|
||||
"/helmet"
|
||||
],
|
||||
"_resolved": "https://registry.npmjs.org/x-xss-protection/-/x-xss-protection-1.1.0.tgz",
|
||||
"_shasum": "4f1898c332deb1e7f2be1280efb3e2c53d69c1a7",
|
||||
"_shrinkwrap": null,
|
||||
"_spec": "x-xss-protection@1.1.0",
|
||||
"_where": "/Users/gerrit/Documents/dev/nodejs/rentfor.camp/html/RentForCamp/node_modules/helmet",
|
||||
"author": {
|
||||
"name": "Adam Baldwin",
|
||||
"email": "baldwin@andyet.net",
|
||||
"url": "http://andyet.net/team/baldwin"
|
||||
},
|
||||
"bugs": {
|
||||
"url": "https://github.com/helmetjs/x-xss-protection/issues"
|
||||
},
|
||||
"contributors": [
|
||||
{
|
||||
"name": "Evan Hahn",
|
||||
"email": "me@evanhahn.com",
|
||||
"url": "https://evanhahn.com"
|
||||
}
|
||||
],
|
||||
"dependencies": {},
|
||||
"description": "Middleware to set the X-XSS-Protection header",
|
||||
"devDependencies": {
|
||||
"connect": "^3.6.5",
|
||||
"mocha": "^4.1.0",
|
||||
"standard": "^10.0.3",
|
||||
"supertest": "^3.0.0"
|
||||
},
|
||||
"directories": {},
|
||||
"dist": {
|
||||
"integrity": "sha512-rx3GzJlgEeZ08MIcDsU2vY2B1QEriUKJTSiNHHUIem6eg9pzVOr2TL3Y4Pd6TMAM5D5azGjcxqI62piITBDHVg==",
|
||||
"shasum": "4f1898c332deb1e7f2be1280efb3e2c53d69c1a7",
|
||||
"tarball": "https://registry.npmjs.org/x-xss-protection/-/x-xss-protection-1.1.0.tgz",
|
||||
"fileCount": 4,
|
||||
"unpackedSize": 4397
|
||||
},
|
||||
"gitHead": "0eee3ec81be3ed1189d2fff1e402057c19a48de6",
|
||||
"homepage": "https://github.com/helmetjs/x-xss-protection#readme",
|
||||
"keywords": [
|
||||
"helmet",
|
||||
"security",
|
||||
"express",
|
||||
"connect",
|
||||
"xss",
|
||||
"x-xss-protection"
|
||||
],
|
||||
"license": "MIT",
|
||||
"maintainers": [
|
||||
{
|
||||
"name": "evanhahn",
|
||||
"email": "me@evanhahn.com"
|
||||
}
|
||||
],
|
||||
"name": "x-xss-protection",
|
||||
"optionalDependencies": {},
|
||||
"readme": "ERROR: No README data found!",
|
||||
"repository": {
|
||||
"type": "git",
|
||||
"url": "git://github.com/helmetjs/x-xss-protection.git"
|
||||
},
|
||||
"scripts": {
|
||||
"pretest": "standard --fix",
|
||||
"test": "mocha"
|
||||
},
|
||||
"standard": {
|
||||
"globals": [
|
||||
"describe",
|
||||
"before",
|
||||
"beforeEach",
|
||||
"it"
|
||||
]
|
||||
},
|
||||
"version": "1.1.0"
|
||||
}
|
||||
Reference in New Issue
Block a user